An approved agent. An inappropriate action. Which control stops it?
No request awaiting approval. Try scenario 4 to route a valid refund here.
A held request cannot execute until you decide. Approval applies only to this request.
This conceptual lab is inspired by the three control categories in the supplied slide: IAM policy, a dynamic policy engine, and service extensions. The serial checkpoints visualize separate decisions; they do not assert a particular vendor's deployment architecture. All requests and approvals are simulated locally.
The IAM-only lane deliberately gives approved agents coarse access to all three demo tools. Real IAM can also enforce granular permissions and conditions. The point is that access permission alone does not establish that every permitted action matches the user's current task.
Dynamic policy levels: 1 — Intent: only task-aligned actions pass (summary → read; refund → read or refund; export → read or export). 2 — Context: also blocks export of restricted data. 3 — Strict: also blocks refunds above $5,000. The service extension holds every refund over $1,000 for approval, independently of dynamic policy. These are invented teaching rules, not product defaults or an actual natural-language policy engine.
A harmful execution is an action by an unapproved agent, an action outside the user's task, or a restricted-data export. Missing business approval is counted separately in the audit. Counters are cumulative until Reset. The two lanes receive the same request snapshot. Changes to controls affect the next request. Scenario selection cancels in-flight requests and pending approvals; Reset clears counters and returns to scenario 1.
Use Guided demo for all five scenarios. It pauses at the approval desk until you approve or reject. Send request repeats the current experiment. Animation speed changes presentation timing only; it does not change the policy outcomes. Keyboard: Space pauses/resumes when focus is outside a control.